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Navigating risks 


Navigating risks 


Risk management at A.P Moller - Maersk is focused to support the strategic 
objectives in the medium term and ensure the longevity in the long term. 
A.P Moller - Maersk’s Enterprise Risk Management framework enables a 
consistent approach to the identification, management and oversight of 
key risks, allowing a holistic and meaningful comparison of the risks faced 
and how they are managed across the company's footprint. 


Identifying A.P. Moller - Maersk’s risks 

Using the enterprise risk management framework, all A.P Moller - Maersk brands 
and functions identify the key risks that could affect their strategy and operations. 
In parallel, key risks to the company's business objectives are identified through 
interviews with executives. Finally, emerging risks to the company's longer-term 
value drivers are identified through an externally facilitated workshop with execu- 
tives. The risks identified are then consolidated into an enterprise-wide risk land- 
scape and validated for relevance and significance by the Risk & Compliance Com- 
mittee. After final consolidation, the risk landscape is reviewed by the Executive 
Leadership Team, who determine the key risks for the company and the emerging 
risks that warrant detailed analysis to understand their potential impact. These risks 
are then submitted to the Audit Committee and the Board of Directors. 


Managing A.P. Moller - Maersk’s risks 

Each key risk is assigned an executive owner who is accountable for the management 
of the risks, including confirmation that adequate controls are in place and that the 
necessary action plans are implemented to bring or keep the key risk within accept- 
able levels, if not already the case. To provide adequate oversight, key risk develop- 
ments and mitigation progress are monitored and reported on throughout the year. 
Quarterly in-dept reviews of the status of the key risks and their mitigation are con- 
ducted in the management teams and various oversight fora such as the Risk & Com- 
pliance Committee and the quarterly performance reviews. In addition, the Audit 
Committee conducts deep dive sessions with executive risk owner throughout the 
year on selected key risks. Figure 1 presents an overview of A.P Moller - Maersk’s 
process and governance structures, including the Risk & Compliance Committee 
and Audit Committee/Board of Directors. 


Figure 1 
Overview of Overview of governance structure Structure 


Brand/Function management 
Provide oversight of the risk management at brand and function level 
Maersk brands and 


functions 
Brand/Function Risk Coordinators 


Facilitate all activities defined under ERM framework, including identification 
and management of key risks at brand and function level 


Brand/Function Risk Owners 

Responsible for managing, measuring, monitoring and reporting on risks at 
brand and function level and for developing and implementing mitigation 
actions for such risks 


Strenethening A.P Moller - Maersk's ERM framework 


Internal Audit 
Provides 
assurance on 
adequacy and 
effectiveness 
of ERM across 
A.P Moller - Maersk 


In 2021, A.P. Moller - Maersk has: Key improvement projects underway consist of: 
- Strengthened the integration of ERM into - Developing a comprehensive and operational 
strategy review and business planning risk appetite framework for the company 
- Strengthened the risk oversight through the - Implementing a global risk tool allowing 
Risk & Compliance Committee and quarterly A.P Moller - Maersk to have single source of risk 
performance reviews and assurance data 
- Conducted a training programme to develop - Assessing the impact of the climate-related risks 
A.P Moller - Maersk's global risk community. and opportunities to meet future requirements and 


aligned with TCFD. 
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Key risks to the business plan 


A.P Moller - Maersk categorises risks into four different areas to provide the 
appropriate level of governance and oversight to effectively manage these risks. 


Strategic 


Risks associated with 
current and future 
business plans and 
strategies 


Operational 


Risks associated with 
business activities and 
operations, procedures, 
people and systems 


Financial 


Risks associated with 
potential financial 
losses and/or 
insolvency 


Compliance 


Risks associated with 
non-compliance with 
rules and/or policies 


ib 

Customer service level 
Inability to deliver a 
superior service level 
to customers 


4. 
Cyber attack 
External or internal 
attack resulting in 
service unavailability 
or data breach 


2. 


Ocean industry collapse 


Financial loss from 
Ocean freight rate 
collapse 


10. 

Legal and regulatory 
compliance 

Being hit by a large 
compliance case 


Ss 

Process standardisation 
& technology roadmap 
Failure or serious delay 
in the standardisation 
of end-to-end processes 
and execution of tech- 
nology roadmap 


Eh 

People safety 

and security 

Failure to ensure the 
safety and security of 
A.P Moller - Maersk's 
employees 


6. 

Mergers and acquisi- 
tions integration 
Failure to integrate a 
major acquisition 


Te 
Strategic hubs 
Shutdown of strategic 
hubs resulting in signifi- 
cant network disruption 


9. 

Decarbonisation 

Failure to decarbonise 
A.P Moller - Maersk's 
end-to-end supply chain 
at a speed that meets 


investors and customers’ 


expectations 


8. 

Organisational 
capabilities 
Inability to attract 
and scale the right 
workforce matching 
business demand 


Figure 2 


A.P Moller - Maersk's key risks 


A.P Moller - Maersk considers risks both individually and collectively to fully 
understand its risk landscape. The company quantifies key risks and the risk 
portfolio to understand how they may impact the performance of its business 
plan and budget and to have an objective basis for monitoring how the key risks 
trend compared to risk appetite. The quantification of the risk portfolio takes 
into consideration diversification benefits in the portfolio. The majority of the 
key risks determined for 2022 remain as they were in 2021, and the only new 
risk is a risk around shutdown of strategic hubs. 


@ December 2021 position 
@ December 2021 - new risk 
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@ Customer service level 


What is this risk 

The success of A.P Moller - Maersk’s integrator 
strategy depends on customers’ trust and confi- 
dence in A.P Moller - Maersk to fulfil their end- 
to-end supply chain needs through superior and 
consistent service levels. A failure to do so would 
be a reputation risk and weaken the foundation of 
A.P Moller - Maersk's integrator strategy. 


Ocean industry collapse 


What is this risk 

Added capacity from planned new ship buildings 
and normalisation of the existing supply-demand 
imbalance due to expected easing of supply chain 
congestion could lead to a rapid collapse in Ocean 
freight rates. 


Process standardisation 
& technology roadmap 


What is this risk 

A serious delay or failure to standardise core end- 
to-end business processes and execute the tech- 
nology roadmap to achieve A.P Moller - Maersk's 
growth vision as an end-to-end integrator of global 
logistics. 


Cyber-attack 


What is this risk 

As A.P Moller - Maersk becomes increasingly digi- 
talised, more devices and control systems are con- 
nected online resulting in a wider technology surface. 
This, compounded with ever-increasing external 
threat capabilities, puts more pressure on systems to 
be cyber threat resilient. A cyber-attack could lead to 
severe operational disruption and/or data breaches. 


Risk owner: CEO of Ocean & Logistics 


How we manage it 

A.P Moller - Maersk has launched several transfor- 
mation projects to mitigate this risk and progress 
towards the distinct delivery promises. The company 
is improving the business processes and systems to 
deliver the delivery promises, with service levels be- 
ing monitored to mitigate adverse developments. 


Risk owner: CEO of Ocean & Logistics 


How we manage it 

A.P Moller - Maersk has limited levers to impact the 
overall demand for container shipping and cannot 
influence the market rates. With the continuing 
development of differentiated value propositions, 
agile network, increased focus on cost leadership 
and a growing long-term contracts portfolio, the 
company will all-else-equal continue to reduce the 
exposure. 


Risk owners: CEO of Ocean & Logistics, CTIO 


How we manage it 

To achieve the right customer and business 
outcomes, A.P Moller - Maersk has implemented 
several mechanisms to accelerate process 
standardisation and technology modernisation 
and monitor progress and process governance 
and cross-functional collaboration. 


Risk owner: CTIO 


How we manage it 

A.P Moller - Maersk continues to execute its cyber 
security programme, strengthen business conti- 
nuity plans and enhance its cyber threat resilience. 
Over the recent years, the company has enhanced 
capabilities to control impact through appropriate 
preparedness and response procedures. 


Year-on-year risk movement: Stable 


Target tolerance 

A.P Moller - Maersk targets a high schedule reliabil- 
ity which is best among peers, a minimal impact on 
customers from commercial overbooking, consist- 
ent performance of delivery promises to customers, 
and a high Net Promoter Score from customers. 


Year-on-year risk movement: Stable 


Target tolerance 

A.P Moller - Maersk anticipates a normalisation of 
freight rates, but the targeted freight rates remain 
above pre-COVID levels reflecting a less volatile 
industry overall. 


Year-on-year risk movement: Decreased 


Target tolerance 

A.P Moller - Maersk targets operational excellence 
in addressing customers end-to-end supply chain 
needs, through effective integration of business 
products, standardised processes and technology 
platforms. 


Year-on-year risk movement: Decreased 


Target tolerance 

A.P Moller - Maersk aims to avoid a material cy- 
ber-attack through increased threat intelligence and 
response capabilities, and builds digital resilience 
with business segments, third parties and wider 
supply chains. 


Risk category: Strategic 


Scenario 

Excessive demand for capacity and port congestion 
due to lack of labour combined with ineffective 
demand forecast and cargo management causes de- 
terioration of service levels and customer dissatis- 
faction and impacts the company’s brand reputation 
and financial performance. 


Risk category: Financial 


Scenario 

A severe contraction of Ocean industry due to ex- 
cess capacity combined with rapid decrease in ocean 
freight rates causes lower cash flow generation 

and distraction to A.P Moller - Maersk's strategy 
execution. 


Risk category: Strategic 


Scenario 

Delay or failure to implement digitised and stand- 
ardised supply chain solutions due to misalignment 
between business and technology causes loss of 
digital competitive advantage and customer dis- 
satisfaction and impacts company's reputation and 
financial performance. 


Risk category: Operational 


Scenario 

Increased direct or indirect attacks on 

A.P Moller - Maersk's brands, third-party partners 
or parts of company’s network due to digitisation, 
threat sophistication and/or vulnerabilities from 
newly M&A environments cause severe business 
disruption and loss of customer trust. 
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@ People safety and security 


What is this risk 

Many of A.P Moller - Maersk employees and exter- 
nal contractors work in high-risk business opera- 
tions and geographies, exposing them to safety and 
security risks. The accelerated expansion into Logis- 
tics & Services increases the risk due to new areas 
of operations and new geographies. 


rs] Mergers and acquisitions 
integration 


What is this risk 

A key driver to Logistics & Services growth is the ex- 
pansion of product and people capabilities through 
M&As. Some of the acquisitions might be substan- 
tial, and if A.P Moller - Maersk fails to integrate 
those, it may derail the execution of the integrator 
strategy. 


@ Shutdown of strategic hubs 


What is this risk 

Hub terminals that handle transhipments are a crit- 
ically important part of A.R Moller - Maersk's supply 
chain management network. The network could be 
disrupted for a prolonged period if a strategic hub 
completely shuts down and there are no options to 
reroute cargo. 


rs] Organisational capabilities 


What is this risk 

A.P Moller - Maersk's strategy to become a global 
integrator of container logistics requires the right 
capabilities. Inability to attract and retain skilled 
staff will impact the ambition to deliver a logis- 
tics-based, digitally transformed business model to 
support the integrator strategy. 


Risk owner: CEO of APM Terminals 


How we manage it 

A.P Moller - Maersk continues to drive personal 
engagement from leaders to ensure sufficient prior- 
itisation of people safety and security. The company 
continues to embed a unified safety and resilience 
framework in the business operation systems, in- 
cluding for M&As and its integration. 


Risk owner: CFO 


How we manage it 


A.P Moller - Maersk has a dedicated post-merger inte- 


gration office equipped with capabilities to assist the 
business in effectively managing M&A integrations. 


A comprehensive M&A integration framework has been 
implemented covering all commercial and functional 

aspects. The integration process is strongly linked to a 
well-structured M&A target identification, due diligence 


and synergy identification process. 


Risk owners: 
CEO of Ocean & Logistics, CEO of APM Terminals 


How we manage it 

A.P Moller - Maersk has business continuity and 
contingency plans to manage disruption to network 
and terminal operations. A central coordination body 
is in place to handle largescale disruption events that 
cut across multiple trades and geographies. Mitigation 
strategies to prevent labour strikes, equipment break- 
downs, etc. are in place for terminal operations and 
embedded into terminal business operating system. 


Risk owner: Chief People Officer 


How we manage it 

A.P Moller - Maersk has acquired new and diverse 
capabilities and skillsets, especially for Logistics & 
Services and technology. The company continues to 
build competencies through functional and lead- 
ership programmes targeted capability sourcing 
matching the business needs, and a strong em- 
ployee value proposition. 


Year-on-year risk movement: Stable 


Target tolerance 

A.P Moller - Maersk targets a high level of duty of 
care towards people through strong safety and 
security standards, awareness of same in all busi- 
ness areas and a mature safety culture across the 
organisation. 


Year-on-year risk movement: Stable 


Target tolerance 

A.P. Moller - Maersk aims to have adequate capabil- 
ities and effective processes to warrant that sub- 
stantial M&As are integrated successfully and on 
time to realise the anticipated benefits as planned. 


Year-on-year risk movement: New risk 


Target tolerance 

A.P Moller - Maersk aims to have adequate and ef- 
fective disruption contingency plans to ensure that 
a shutdown of strategic hubs does not significantly 
deteriorate service levels and delivery promises to 

customers. 


Year-on-year risk movement: Stable 


Target tolerance 

A.P Moller - Maersk targets to be an employer of 
choice able to attract and retain qualified talent and 
skills that are highly engaged and committed to the 
company's values, goals and objectives. 


Risk category: Operational 


Scenario 

Serious incidents due to lack of adequate safety 
standards or security intelligence and failure to 
embed a duty of care culture in day-to-day business 
operations cause injuries and fatalities and damage 
to brand reputation. 


Risk category: Strategic 


Scenario 

A failure to successfully integrate a major acquisi- 
tion due to inadequate integration approach, lack 
of internal processes or capabilities, or cultural 
differences cause value destruction in the form of 
unrealised synergies 


Risk category: Operational 


Scenario 

Shut-down of a strategic hub due to labour strikes, 
cyber-attack, major accident, extreme weather 
events, state emergency, pandemic, etc. causes dis- 
ruption to the Ocean network and impacts service 
level to customers. 


Risk category: Operational 


Scenario 

A.P Moller - Maersk's strategy execution is ham- 
pered by lack of adequate organisational capabil- 
ities essential to match business needs and rapid 
shifts in external business, technology, and regula- 
tory environment. 
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© Decarbonisation 


What is this risk 

Decarbonisation has become business crit- 

ical and a licence to operate. It is critical for 

A.P Moller - Maersk to decarbonise its end-to-end 
supply chain at a speed that meets customers’ and 
investors’ expectations. 


Legal and regulatory compliance 


What is this risk 

The legal and regulatory landscape in which 

A.P Moller - Maersk operates is becoming increas- 
ingly complex, and the company could be subject to 
compliance cases in connection with violations of 
anti-corruption laws, anti-trust regulations, interna- 
tional sanctions and/or data privacy. 


Changes to the key risks 


The process standardisation & technology 
roadmap risk has decreased due to progress of the 
technology modernisation roadmap, and compre- 
hensive plans built for the process standardisation 
agenda, underpinned by strong focus and commit- 
ment from the Executive Leadership Team. 


Risk owner: CEO of Fleet & Strategic Brands 


How we manage it 

A.P Moller - Maersk has a dedicated decarbonisation 
function to drive the decarbonisation agenda. The 
company’s new accelerated 2040 decarbonisation 
vision is in line with the ambition of its customers. 
The first 13 methanol-powered vessels have been 
ordered, and the supply of green fuels for the first 
feeder vessel has been secured. Work on a roadmap 
for landside decarbonisation (and air) is in progress. 


Risk owner: 
General Counsel & Head of Corporate Affairs 


How we manage it 

A.P Moller - Maersk has a subject matter expert in 
each compliance area and a robust compliance pro- 
gramme designed to fulfil the global requirements. 
The company has implemented many initiatives to 
improve focus and emphasis on compliance training 
and awareness. 


The overall risk level for a major cyber-attack has 
decreased due to the enhanced capability to control 
impact and brand damage through preparedness 
and response activity procedure, albeit the likeli- 
hood of an attack has increased amid developments 
in the external threat environment and expansion of 
the attack surface due to digitisation, vulnerabilities 
across IT landscape and newly acquired companies. 


Year-on-year risk movement: Stable 


Target tolerance 

A.P Moller - Maersk targets achievement of its 
decarbonisation vision by innovating supply chain 
solutions and accelerating its decarbonisation ini- 
tiatives to drive credibility towards the customers 
and investors. 


Year-on-year risk movement: Stable 


Target tolerance 

A.P Moller - Maersk is committed to ensuring com- 
pliance with all applicable laws and regulations in 
all the countries where it operates. 


The legal and regulatory compliance risk now 
addresses not only the compliance with anti-cor- 
ruption laws, competition laws, and international 


sanctions but also the compliance with data privacy 


regulations across different geographies. 


Risk category: Strategic 


Scenario 

Uncertainty around the direction of future sustain- 
able fuel market developments, unavailability of 
sufficient amounts of green fuel, and customers’ 
reluctance to adopt sustainable supply chain solu- 
tions causes delay in realising A.P Moller - Maersk's 
decarbonisation vision. 


Risk category: Strategic 


Scenario 

A violation of compliance regulation, including 
stemming from a newly acquired company, could 
cause severe reputational damage and substantial 
legal fines, damages and costs. 
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Looking beyond the planning period 


A.P Moller - Maersk looks beyond the business planning horizon and assesses emerg- 
ing risks in a 5-15 years’ perspective. This is to spot threats or opportunities to the 
long-term value drivers in a timely manner. An emerging risk radar is established based 
on prevailing megatrends seen through different lenses (figure 3). One or two emerg- 
ing risks are then selected for analysis to better understand their potential implica- 
tions for the logistics industry and for A.P Moller - Maersk. For 2022 three emerging 
risks that could potentially impact the company in the longer term were selected for 
focus. Climate change was selected for a detailed analysis, the outcome of which will 
drive articulation and implementation of mitigating strategies. 


1. Climate change 

The physical impacts of climate change may affect A.P Moller - Maersk's land-based 
assets and operations and the supply chains it operates. A.P Moller - Maersk is con- 
ducting an in-depth analysis to understand and manage the risks from the physical 
effects of climate change. As underscored by the latest Intergovernmental Panel 
on Climate Change (IPCC) report, August 2021, the risks are real, and there is a need 
for a detailed analysis of their potential impact on A.P Moller - Maersk. The analysis 
includes assessment of climate scenarios and their impact on company's operations 
in relevant locations, i.e. the land-based assets, the extended infrastructure on 
which the company depends and the vessel operations. Further studies are planned 
to examine the impact of climate change on the supply chains it operates. Besides 
addressing the need to understand the impact of the physical effects of climate 
change on the business, the study will also enable A.P Moller - Maersk to expand and 
enhance the disclosure on climate related risks and opportunities in line with Task 
Force on Climate-related Financial Disclosures (TCFD) recommendations. 


2. Slow adaptation to technology-enabled simple supply chain models 

A.P Moller - Maersk's integrator strategy depends on customers demanding simplified 
supply chain models. A lagging adoption of technology-enabled simple solutions could 
make the strategy irrelevant. Supply chains today are characterised by series of complex 
processes. Increased globalisation and shifting consumers demand add further com- 
plexities to supply chains. In response to these complexities, companies have started to 
adopt and utilise advanced technologies to transform and simplify their supply chains 
and enhance the customer experience. A.P Moller - Maersk is advancing its strategy to 
digitise the customer interface and product offerings. However, if A.P Moller - Maersk 
does not move fast and remain ahead of its peers in developing solutions aligned with 
its integrator strategy and customer demands, A.P Moller - Maersk may not be able to 
provide superior value propositions to its customers. 


3. Change in trade patterns 

A.P Moller - Maersk business model is global and dependent on the global economy 
and international trade. Consequently, fundamental changes in trade patterns could 
expose the current business model to risk. COVID-19 has led companies to revisit 
their supply chain models and evaluate alternative models to meet customer needs 
through more resilience and diversification (e.g. dual sourcing, near shoring etc.). 
Customer behaviours are also changing with an increased push for climate and social 
goals and opportunities arising from technology potentially leading to avoidance of 
long-haul transportation and manufacturing closer to market. Further, rising nation- 
alism, populism, and protectionism (e.g. USA/China decoupling) could imply a retreat 
from globalisation towards an increased regionalisation of trade patterns. 


Figure 3 
Emerging risks radar 
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O covip-19 


As the world moves into its third year battling COVID-19, A.P Moller - Maersk 
remains focused on protecting employees, supporting customers and contributing 
to societies by keeping goods flowing. 


To achieve these objectives, regional and local leaders across the company have 
since early in the pandemic been empowered to set up the necessary protective 
measures across offices and onshore frontline facilities and a globally coordinated 
approach has been taken to keep vessels and ocean network operational. A central 
cross-functional COVID Coordination Team has provided strategic oversight, contin- 
uously evaluating risks and opportunities and providing leaders with updated infor- 
mation, guidance, tools and resources. 


This approach has enabled A.P Moller - Maersk to minimise infections and largely 
maintain business continuity throughout 2021 despite recurring global infection 
waves and constant change of local regulations and requirements. 


All employees are kept closely informed about the evolving protective measures at 
their locations and are provided with appropriate instructions on safety protocols 
and personal protective equipment (PPE). Where relevant, vaccination drives are 
facilitated, not least for seafarers whose ability to safely travel to and from vessels 
may be affected by their vaccination status. Office employees have worked from 
home for large parts of the year, and business travel was restricted for most of 
2021. Through effective communication, processes, systems and steadfast resolve 
from leaders, employees have been able to continue to work effectively to support 
customers and achieve business objectives. 


A.P Moller - Maersk has sadly lost more than 90 colleagues to COVID-19 since the 
beginning of the pandemic. The company has set up a relief fund to support the 
families of those employees who have fallen seriously ill or lost their life due to 
the virus. 


Looking ahead to 2022, the COVID-19 situation across the globe is expected to 
continue to evolve, as seen with the newest variant of concern Omicron which is 
spreading at an alarming rate and has been detected in almost all countries world- 
wide. Operating conditions for A.P Moller - Maersk vessels and seafarers will also 
continue to require special attention in the year ahead due to varying restrictions 
to crew change globally and this serious issue continues to be addressed through 


collaboration with governments and port authorities. 
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